What your ISP can see when you use a VPN

With a VPN connected, your ISP sees that your phone is exchanging encrypted data with one address, the VPN server, and roughly how much and when. It does not see the names of the websites you visit, your DNS lookups, or anything inside the pages and apps you use. Those travel inside the tunnel, and the ISP carries only the outside of it.

That is the direct answer. The longer one is about what your ISP could see before, what it still knows now, and where that visibility went.

What your ISP sees without a VPN

Every packet your phone sends crosses your ISP's network, so without a VPN it can read anything that is not encrypted and the addressing on everything that is. In practice that means:

• DNS lookups. Before your phone connects to a site it asks a resolver for the site's address, and by default that resolver is the ISP's own. Each lookup is a plain-text record of a site name you are about to visit.
• The site name in the TLS handshake. Even when the page is HTTPS, the first message your phone sends carries the server's name unencrypted so the server knows which certificate to present. This is the SNI field, and anyone on the path can read it.
• Destination addresses and ports. The IP address of every server you talk to, which is often enough to identify the service without a name.
• Timing and volume. When you were online, for how long, and how much you sent and received.
• Contents of anything unencrypted. Rare on the modern web, but old apps and some embedded content still use plain HTTP.

The post on what a VPN hides goes through the same list from the other side.

What changes when the tunnel is up

A VPN wraps every one of those packets, DNS included, inside an encrypted connection to one server. The ISP now carries a single stream between your phone and that server, and each packet in it looks the same from outside: encrypted bytes, to one address, on one port.

The last three rows are the honest limits. Your ISP still bills you, still assigns your address, and still sees the size and timing of everything. It cannot read the stream, but it can measure it.

What your ISP still knows

Three things do not change, and it is worth being clear about them.

That you are using a VPN. A long-lived encrypted connection to one address, often on a port associated with VPN protocols, is recognisable, and the addresses of VPN servers are not secret. Some apps can run the tunnel inside TLS on port 443, which is what ordinary web browsing uses, so the stream looks like any other HTTPS connection.

How much you use. Data caps, throttling and fair-use policies are all applied to volume, and a VPN does not change the volume. If anything it adds a few percent of overhead for the tunnel's own headers.

Who you are. Your ISP has your name, address and payment details from the day you signed up. A VPN hides what you do, not that it is you doing it.

Where the visibility goes

A VPN does not remove the party that can see your traffic. It moves the role from your ISP to the VPN provider, whose server decrypts the tunnel and sends your traffic on to its destination. That server can see everything the ISP used to: DNS lookups, site names, destination addresses and volume.

So the question to ask of any VPN is what it does with that view. Not the slogan on the download page, but what the privacy policy says is recorded, kept and shared. The logs explainer lays out the kinds of record a provider might keep and which ones matter.

Culvert VPN does not log the websites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id, and the one thing it does keep is your client IP address, for up to 30 days, for handling abuse complaints, as set out in its privacy policy.

Mobile data is the same story

On mobile data the carrier is the ISP, and everything above applies without change. The carrier sees one encrypted stream to the VPN server, plus the timing and volume it would see anyway. One difference: carriers commonly put phones behind shared addresses, so from a website's point of view your real address was already shared with thousands of other subscribers. The VPN's job there is less about hiding your address and more about keeping site names and DNS out of the carrier's view.

A quick way to confirm it

Connect the VPN, open the connect screen and look for the exit IP. If the app shows the VPN server's address, and it got that answer by asking a server through the tunnel, your traffic is going where you think. The exit IP post explains why that check should be done through the tunnel and against the provider's own server rather than a third-party site.

If you want that view of your traffic taken off your ISP with a single tap, Culvert VPN's free tier connects to servers in the Netherlands, France and Germany and shows the exit IP it verified through the tunnel, on Google Play.